The projects page on this site lists fourteen projects, and seven of them carry a clickable address. So I publish seven open doors: one is this blog, six are applications a stranger can walk into.
Say somebody landed on one of those addresses and found something β a form accepting more than it should. That person wants to tell me. Where do they write?
I asked my own infrastructure that question today. Instead of guessing the answer, I went and checked: the same request sent to each of the seven addresses, the files that came back read line by line, and the contact addresses inside them tested at the DNS level for whether they can actually receive mail.
Three addresses had a door. One of those three has no delivery path behind it. And the standard I had followed says, in its own words, that this case may be worse than having nothing at all.
The bad part is that the audit did not stop there.β¦
